Commands and permissions

Commands

/lock, and it also answers to /2fa, /elock and /emberlock.

Command	What it does
/lock setup	Enrol: pick an authenticator app or a PIN
/lock code <code>	Answer a prompt with a code from your app
/lock recovery	Show your single-use recovery codes
/lock status [player]	Whether an account is enrolled, and with what
/lock trust	Remember this device
/lock forget	Forget every remembered device
/lock remove [player]	Remove a second factor. Always audited
/lock now	Lock yourself. The button before you walk away
/lock all [player]	Challenge everyone online, or one person
/lock unlock <player>	Lift a lockout early
/lock editor	The settings editor
/lock reload	Reload the config

Permissions

Twenty-three nodes: twenty individual ones and three bundles. Every one is declared in plugin.yml with a description, so they appear properly in whatever permissions plugin you run.

Policy: who has to do what

Node	Default	Grants
emberlock.use	everyone	May set up a second factor voluntarily
emberlock.force	no	Must have a second factor. Give this to staff
emberlock.force.totp	no	Must use an authenticator app; a PIN will not satisfy it
emberlock.bypass	no	Never challenged at all. Dangerous, grant to nobody by default
emberlock.stepup.exempt	no	Never re-challenged before a guarded command
emberlock.notify	operators	Receives lockout and recovery alerts in game

What a player can do

Node	Default	Grants
emberlock.command.setup	everyone	/lock setup
emberlock.command.setup.pin	everyone	Choose a PIN rather than an authenticator app
emberlock.command.code	everyone	Answer a prompt with /lock code
emberlock.command.recovery	everyone	View and use recovery codes
emberlock.command.remove	everyone	Remove their own second factor
emberlock.command.status	everyone	See their own status
emberlock.command.trust	everyone	Remember this device
emberlock.command.forget	everyone	Forget every remembered device

What staff can do

Node	Default	Grants
emberlock.command.remove.other	operators	Remove another player's second factor. Always audited
emberlock.command.status.other	operators	See another player's status
emberlock.command.all	operators	Lock every online account at once
emberlock.command.editor	operators	Edit the settings in game
emberlock.command.unlock	operators	Lift a lockout
emberlock.command.reload	operators	Reload the config

Bundles

Node	Default	Contains
emberlock.player	everyone	The eight player commands, plus emberlock.use
emberlock.admin	operators	The six staff commands, plus emberlock.notify
emberlock.*	no	emberlock.admin, emberlock.player and emberlock.force

emberlock.* is every command, for staff and players alike. It deliberately does not grant emberlock.bypass, emberlock.force.totp or emberlock.stepup.exempt. A wildcard that handed out bypass would quietly exempt every admin group from the plugin you installed to protect them, which is the one way a second factor fails without anybody noticing. It does grant emberlock.force, so a wildcard makes an account more locked down, not less.

# Staff must have a factor, and it has to be a real one
lp group mod permission set emberlock.force true
lp group admin permission set emberlock.force.totp true

Requirements

Server	Paper, Purpur or Folia, 1.21 to current
Java	21 or newer
Needs	Nothing
Optional	Floodgate for native Bedrock forms, MySQL for a network, Ember Forge or ItemsAdder for custom keypad art

One jar covers the whole version range: it is compiled against the oldest API in it, so it uses nothing that was added later.